[AAT] Fix anchor bound checking, again

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12532
Fixes https://bugs.chromium.org/p/chromium/issues/detail?id=922303

src/hb-aat-layout-ankr-table.hh

@@ -69,7 +69,8 @@ struct ankr
     if (!offset)
       return Null(Anchor);
     const GlyphAnchors &anchors = StructAtOffset<GlyphAnchors> (&(this+anchorData), *offset);
-    if (unlikely (end - (const char *) &anchors < anchors.len.static_size ||
+    if (unlikely (end < (const char *) &anchors ||
+		  end - (const char *) &anchors < anchors.len.static_size ||
 		  end - (const char *) &anchors < anchors.get_size ()))
       return Null(Anchor);
     return anchors[i];